Public exploitation

Exploit catalog

Every public exploit we catalog, in one index. Search by CVE, exploit name or technology — and see, right beside it, what the flaw is actually worth: severity, exploitation probability, and whether it’s already under attack.

86,991cataloged exploits
40,452CVEs with public exploitation
24,696lab-tested
AllReferência 26,240Exploit-DB 24,488GitHub PoC 18,044VulnCheck XDB 10,121Nuclei 4,561Metasploit 3,537✓ verified onlyrecentpopularrisk
18,020 exploits
GitHub PoC★ 5
Simple scanner for scanning a list of ip-addresses for vulnerable Ivanti Pulse Secure devices
CVE-2023-46805HIGHunder attackransomware16 Jan 2024
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re
100RISK
open ↗
GitHub PoC★ 26
CVE-2023-22527 - RCE (Remote Code Execution) Vulnerability In Confluence Data Center and Confluence Server PoC
CVE-2023-22527CRITICALunder attackransomware16 Jan 2024
A template injection vulnerability on older versions of Confluence Data Center and Server allows an unauthenticated atta
100RISK
open ↗
GitHub PoC★ 58
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x, 22.x) allows an authenticated administrator to send specially crafted requests and execute arbitrary commands on the appliance.
CVE-2024-21887CRITICALunder attackransomware16 Jan 2024
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,
100RISK
open ↗
GitHub PoC★ 23
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a remote attacker to access restricted resources by bypassing control checks.
CVE-2024-21887CRITICALunder attackransomware16 Jan 2024
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,
100RISK
open ↗
GitHub PoC
Exploit information for CVE-2023-26602
CVE-2023-26602—16 Jan 2024
ASUS ASMB8 iKVM firmware through 1.14.51 allows remote attackers to execute arbitrary code by using SNMP to create exten
28RISK
open ↗
GitHub PoC
Pol-Ruiz/CVE-2021-4034
CVE-2021-4034HIGHunder attackransomware16 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
GitHub PoC
Exploit information for CVE-2023-26609
CVE-2023-26609HIGH16 Jan 2024
ABUS TVIP 20000-21150 devices allows remote attackers to execute arbitrary code via shell metacharacters in the /cgi-bin
53RISK
open ↗
GitHub PoC
Proof of Concept script to exploit CVE-2023-42793 (TeamCity)
CVE-2023-42793CRITICALunder attackransomware15 Jan 2024
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
open ↗
GitHub PoC★ 6
CVE-2021-3129
CVE-2021-3129CRITICALunder attackransomware15 Jan 2024
Ignition before 2.5.2, as used in Laravel and other products, allows unauthenticated remote attackers to execute arbitra
100RISK
open ↗
GitHub PoC
1.验证CVE-2016-4437、2.解析rememberMe的文件和CBC加密的IV偏移
CVE-2016-4437CRITICALunder attack15 Jan 2024
Apache Shiro before 1.2.5, when a cipher key has not been configured for the "remember me" feature, allows remote attack
100RISK
open ↗
GitHub PoC★ 7
POC Checker for ivanti CVE-2024-21887 Command injcetion
CVE-2024-21887CRITICALunder attackransomware14 Jan 2024
A command injection vulnerability in web components of Ivanti Connect Secure (9.x, 22.x) and Ivanti Policy Secure (9.x,
100RISK
open ↗
GitHub PoC★ 10
Scanner for CVE-2023-46805 - Ivanti Connect Secure
CVE-2023-46805HIGHunder attackransomware14 Jan 2024
An authentication bypass vulnerability in the web component of Ivanti ICS 9.x, 22.x and Ivanti Policy Secure allows a re
100RISK
open ↗
GitHub PoC
Program ini adalah alat (tool) yang dibuat untuk memeriksa keamanan sistem Minio terkait dengan kerentanan CVE-2022-35919
CVE-2022-35919HIGH13 Jan 2024
Authenticated requests for server update admin API allows path traversal in minio
53RISK
open ↗
GitHub PoC★ 245
This repository presents a proof-of-concept of CVE-2023-7028
CVE-2023-7028CRITICALunder attack12 Jan 2024
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RISK
open ↗
GitHub PoC★ 3
An issue has been discovered in GitLab CE/EE affecting all versions from 16.1 prior to 16.1.6, 16.2 prior to 16.2.9, 16.3 prior to 16.3.7, 16.4 prior to 16.4.5, 16.5 prior to 16.5.6, 16.6 prior to 16.6.4, and 16.7 prior to 16.7.2 in which user account password reset emails could be delivered to an unverified email address.
CVE-2023-7028CRITICALunder attack12 Jan 2024
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RISK
open ↗
GitHub PoC★ 58
CVE-2023-7028
CVE-2023-7028CRITICALunder attack12 Jan 2024
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RISK
open ↗
GitHub PoC
CVE-2023-7028 poc
CVE-2023-7028CRITICALunder attack12 Jan 2024
Weak Password Recovery Mechanism for Forgotten Password in GitLab
100RISK
open ↗
GitHub PoC★ 1
Simple Student Attendance System v.1.0 - Multiple SQL injection vulnerabilities - student_form.php and class_form.php
CVE-2023-51801CRITICAL11 Jan 2024
SQL Injection vulnerability in the Simple Student Attendance System v.1.0 allows a remote attacker to execute arbitrary
48RISK
open ↗
GitHub PoC★ 1
PoC for CVE-2022-1388 affecting F5 BIG-IP.
CVE-2022-1388CRITICALunder attackransomware09 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
GitHub PoC★ 12
PoC Script for CVE-2022-36267: Exploits an unauthenticated remote command injection vulnerability in Airspan AirSpot 5410 antenna.
CVE-2022-36267—08 Jan 2024
In Airspan AirSpot 5410 version 0.3.4.1-4 and under there exists a Unauthenticated remote command injection vulnerabilit
35RISK
open ↗
GitHub PoC
johnossawy/CVE-2023-42793_POC
CVE-2023-42793CRITICALunder attackransomware07 Jan 2024
In JetBrains TeamCity before 2023.05.4 authentication bypass leading to RCE on TeamCity Server was possible
100RISK
open ↗
GitHub PoC
MS-NRPC (Microsoft NetLogon Remote Protocol)/CVE-2020-1472
CVE-2020-1472MEDIUMunder attackransomware07 Jan 2024
Netlogon Elevation of Privilege Vulnerability
100RISK
open ↗
GitHub PoC
Local Privilege Escalation (LPE) vulnerability in Polkit - Pwnkit
CVE-2021-4034HIGHunder attackransomware06 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
GitHub PoC
Clone from gist
CVE-2021-26855CRITICALunder attackransomware04 Jan 2024
Microsoft Exchange Server Remote Code Execution Vulnerability
100RISK
open ↗
GitHub PoC
Script to validate WordPress CVE-2022-21661
CVE-2022-21661HIGH04 Jan 2024
SQL injection in WordPress
78RISK
open ↗
GitHub PoC★ 1
touch 生成文件
CVE-2021-4034HIGHunder attackransomware04 Jan 2024
A local privilege escalation vulnerability was found on polkit's pkexec utility. The pkexec application is a setuid tool
100RISK
open ↗
GitHub PoC
julienbrs/exploit-CVE-2023-3460
CVE-2023-3460—04 Jan 2024
Ultimate Member < 2.6.7 - Unauthenticated Privilege Escalation
60RISK
open ↗
GitHub PoC★ 3
exploit poc
CVE-2022-1388CRITICALunder attackransomware03 Jan 2024
On F5 BIG-IP 16.1.x versions prior to 16.1.2.2, 15.1.x versions prior to 15.1.5.1, 14.1.x versions prior to 14.1.4.6, 13
100RISK
open ↗
GitHub PoC★ 4
CVE-2020-11023 PoC for bug bounty.
CVE-2020-11023MEDIUMunder attack03 Jan 2024
Potential XSS vulnerability in jQuery
85RISK
open ↗
GitHub PoC
Sumitpathania03/CVE-2022-22947
CVE-2022-22947CRITICALunder attack03 Jan 2024
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack whe
100RISK
open ↗
← previouspage 381 / 601next →

We index only the public link to the proof of concept — we never host or redistribute exploitation code. Sources: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit and VulnCheck XDB. A public PoC existing does not mean the flaw is exploitable in your environment.